TW200304616A - Device and method for calculating a result of a division - Google Patents

Abstract

A device for calculating a result an integer multiple of the result (Q) of a division of a numerator (A) by a denominator (N) comprises a means (12) for providing a factor that is selected such that a product of said factor and the denominator is greater than said result. The device comprises furthermore a means (14) for modular reduction of a first product of the numerator and the factor making use of a modulus that is equal to a sum of a second product of the denominator and the factor and an integer, in order to obtain an auxiliary quantity comprising said result. A means (16) is use for extracting the result or the integer multiple of the result from the auxiliary quantity. A division thus is broken down into a modular reduction and an extraction involving no computational expenditure, so that in particular with long-number division tasks, rapidity on the one hand and safety on the other hand are enhanced.

Description

200304616

[Background of the Invention] The present invention relates to cryptographic algorithms, and in particular, to a division algorithm suitable for cryptographic applications. [Knowledge] In cryptographic algorithms, the division of two long numbers is often a non-RSA algorithm. For example, the modulus N is the product of two prime numbers p and q, and q is the use of N It is obtained by dividing by p, or p is obtained by dividing N by ^. If the password coprocessor (coprocess0r) is used ^ (routine) is not used to include micro-commands (micr〇-c〇mma ^), which It can be quickly released internally (work ffff), and the explicit order is carried out, then this division needs to be achieved by software. In view of this, on the one hand, the learning sequence will be very slow, and on the other hand, it will be difficult to resist the simple power analysis (SPA) attack. Common division procedures, for example, as described in "Computational Arithmetic" (Henessy and Patterson 'Morgan Kaufmann, 1996), are recursive divisions, non-revertive divisions, etc., which are based on register translation, where, Subtraction or addition is achieved separately according to whether a particular bit has a particular value. This type of program is very vulnerable to simple power analysis (spA): because current or power consumption, and other time consumption, depend on the number of processes. Therefore, the attacker can probe based on the current and time = the number of lines to be processed, and then probe, for example, the public key cryptographic nose key.

200304616 V. Description of the invention (2) To overcome a problem, the conventional method will set up a so-called virtual operation to obtain the homogenization of the current curve. However, the establishment of virtual computing needs to bear additional performance losses, which can even be as high as ·. . In view of this, the main object of the present invention is to provide a more efficient and safer method to complete the work of division calculation. I am glad that the above-mentioned object of the present invention is achieved by using a device for calculating division as described in item 1 of the scope of patent application, a device for fruiting, or a method for calculating the result of division as described in item 5 of the scope of patent application. The present invention is based on the following findings, that is: especially for cryptographic purposes, the f ϊ 法 method must leave the traditional division procedure 'in order to perform the division calculation. The invention can be divided by the addition of a factor into a modulus approximation For (modular reduction, Ganshan, 丄, this factor and this division denominator) (de where ·, V fixed factor; the choice is to make the result of this division. The product of this can be greater than the denominator and the second factor of this factor: use Modulus (which is equal to the first multiplication of this sub (numerat〇r) and this factor "Auxiliary number of the division result. The most cook, >## 班 到 班 廷 括-鬼 士 & & Dare to end 'This result can be calculated directly from this auxiliary quantity without the need to calculate the cost of the amount. According to the method of the present invention, the nominal quantity (that is, the numerator or the inter-curve curve is independent of where it is beneficial. . In addition, this module; two: 丄;: ",, will cut the result extra) can also use the calculation effect ^ ^ 什, even the final cut of the division

Wicien " method to reach sheep. (Special = 200304616 V. Description of the invention (3) The method is usually implemented in hardware in the Mima coprocessor. Therefore, this modulus reduction can be calculated quickly and efficiently. According to this hardware In the implementation of a register with a sufficient length, the step of extracting the division result from this auxiliary quantity can be read directly from a register with a long number. Or 'the step of extracting the result of the division is also It can be achieved by additional modulus reduction and subtraction. In this case, the calculation cost will still be kept within reasonable limits, because the additional modulus reduction can also use efficient reduction circuits (such as password sharing Processor), implemented quickly and safely. In addition, the method according to the present invention can also provide a specific acceleration of this division and at the same time increase its security. The division of long numbers is described in Infineon Technology Corporation 1 (Munich, In Germany, a known processor advanced Mimar engine (A ◦ e) requires a total of 2 7 clocks / bit. However, according to the division of the present invention, the same place On the device, only 6 clocks / bits are needed, which is an acceleration corresponding to a factor of 4 5 times. At the same time, the division according to the present invention can also be exempted from the simple power analysis (SPA) attack. Because the consumption of current and time is a specific bit pattern that is independent of the number of processes (that is, this numerator and this denominator). [Preferred Embodiment] Before referring to the drawings in detail, the preferred embodiment will first derive the division , Which is based on the first product of the numerator and the factor ^ points, where the modulus is equal to the sum of the denominator and the factor, a complete product, and an integer.

200304616 V. Description of Invention (4)

Denominator N According to the following equation, the desired result Q of the present invention is the numerator ^ divided by

N

A is not limited by generality. The present invention can assume that the numerator A and the eight are: the number of binary, so the following two inequalities will hold: the knife mother N is a -ι < A < 2a η -ι & lt < 2n (2a (2b inequality (2a) and (2b) are the females representing the numerator a and denominator n, 々 equation (1) can be converted as follows:

A Η (3a Equation (3a) The value Η can be calculated as follows: Η

A

Q

N (3b results Q, which will be discussed below. The value H is greater than or equal to 0 and less than N. As can be seen from equation (3), this division 'is a unitary integer result' and this number is the result of this division. Then H: the remainder. Therefore, the number u of the molecule u can be calculated using the structure Λ, and the eigen is the modulus, which can be obtained by dividing the modulus.

Page 9 200304616 V. Description of the invention (5)

H = A

mod N (4) should point out that any floating-point division can be cut into integer divisions, 2 ie: J comes? Second, use the translation decimal point and round to the next whole number. The floating-point division within the OR logic order 70 is usually cut into integer divisions. The number of rounds 发明 发明 invention 发明 This embodiment will add a factor F, which is defined in the number system as follows: When this example is only Η, the number is the number 2, that is, as an example of the binary number system , The base factor F is the exponent e of the base 2

Invented, this factor F must satisfy the following conditions: According to this > and when the inequality (6) is inserted into the equation, 2e > mother (G: Γ) factors: the decision is to let this factor F And this division eight Q. )) The product can be greater than the division knife you want to calculate < 々 The result should refer to 疋 out of the middle s ’The present invention does not need to know the exact Ι1Η» division

Page 10 200304616 V. Description of Invention (6) Size. ^ The size level of the solid result Q 'ϋ to mark the factor ^ of the small second i from the denominator and the numerator to predict the division result μ t Λ ^^^^^ (6) Λ6! The factor F: 2 $ Therefore, This algorithm can ensure that p I is large and w factors F are sufficient to select a large number. It is necessary to choose a small number because ^ is a good% ^, because the number f is chosen to be a large number, and the V method Λ is the // register length. * In the case of this number of cries, the present invention will require a very long temporary: two counter, when this factor _ is selected to be a smaller case τ, the present invention ^ 2 4 uses a shorter temporary storage Device. The following inequality < (8) is the preferred size of the quantity e in the binary representation example (equation (5)):

Page 11 200304616 V. Explanation of the invention (7) ------- In addition, 'equation (4) will also multiply this on both sides to get the equation (1 0): 5 # u Η · F = A · F mod (N · F) (10) In addition, the following inequality will also hold at the same time: 〇 ^ Η · F ^ Ν · F (11) Inequality (11) means: the modulus of inequality (10) is reduced The result must be in the remainder category of this modulus N · F, that is: it must be greater than or equal to 0 and less than Nf 0 ... on the right-hand side of equation (9) to the following equation: f adds and subtracts the result Q Can get

A

(12) Next, the present invention will convert

In the first two terms of the edge, the result X U2), and the right hand of equation (12) will become: The factor of " is decomposed, and equation (12) will be

A · F

(13) Alternatively, transform the equation (1 2 to form Η The present invention can also

Bian Yishou C, left Q, formula F, etc. to the value of the difference \) /} and r total 1,200,304,616 5. Description of the invention (8) and the sum of Q, not the difference: AFQ (NFl) + Η · F + Q (13 ') In addition, the equations (13) and or, and the equations (13) and (13') can be equal to the following equation: HF-Q = A- F- Q (N · F + 1) (14) The following equation is the result of the π-sum alternative ": Η · F + Q = AF-Q (N · F -1) (14,) Compare equations (14) and (14,) With equations (13) and (13,), we can know that equation (1 4) is a new definition of a new division, where equations (14) and (1 4 ') on the left-hand side The difference or sum (that is, the auxiliary quantity (HF-Q) or (HF + Q)), which has the result you want to calculate, respectively, will correspond to the numerator A. F and denominator (NF +1) and (NF -1) The remainder of the integer division. The remainder of this division, that is: the auxiliary number on the left-hand side of equation (1 4), can be calculated using the following equation (1 5) similar to equation (4) ... Η · F-Q = A · F mod (N · F +1) (15)

Page 13 200304616 V. Description of the invention (9) Therefore, equation (1 5) can represent the modulus reduction of the last name F-Q, among which, want to be divided. The result is an auxiliary value Η. The extra cost 1 is used to formulate I in various ways. For example, if Q is used, this division can be constituted without increasing formula (1 5). (In this way, the isocentric modulus is reduced. It should be pointed out However, the medium cut by u)) is negative. In this case, the difference value of the present invention can also be used to satisfy this equation, because the root c difference values can be negative. The result of the reduction of the kernel number is not as much as the "summation alternative" "This embodiment will obtain the following equation: Η A · F mod (N · F -1 15 ') Phase it: the text will refer to &, There are many other ways to calculate the result Q with this auxiliary value HF +/- Q. The points A A reach this-head :, ', the present invention a hundred first reference to Figure 3, to prove that the square of this = number temporary, device _, which has the equation (15 ... side of the modular carry bit) side . It is said that the (largest bit) side and the LSB (the minimum of this register 300 are based on the following, by which to store these numbers η f, the number of processing: XF is a large number 'and refer to its bitmap L a should be 3 The number 所示 shown in the figure, because this number H. F is obtained (the number Η is shifted to the left of this long number register 丨 one place) Page 14 200J04616 V. Description of the invention (10) Select this factor F as 2e. In addition, the number of binary counties Η XF in Figure 3 will also have a small, temporary register 300, compared to the negative or positive number of this calculation result Q. If greed \ 7 Project "— / + Qn, that is, if you want to count the factor F, choose to be very large, so that: ::: temporary-register 300 is very large, and overlap occurs in this register 300, such as -And + Q will not temporarily pass this number, Q can be passed, including the situation shown in the example, the + Q that you want to calculate can be passed through this number: 300 f on Q f to read. This number The minimum bit Us of this register is passed. According to this special consideration (it will get the corresponding bit of this number side must Adding the bitmap in register 300 can use the conventional 2's complement, temporary element, so as to get the calculation you want. In this embodiment, you can only add 1 to the inverted bit. And, 太 春 斤 早 MEN 异 术 运 # 其 是 疋 术 运 异 Such as, for example, 'use the subtraction of the contents of this register. Because these numbers F · F and Q numbers 詈The reduction of Kariya by β Tan from the mountain's number difference 'The present invention can easily, the value pay -k =' Via an appropriate register 3 00 Individual ::: Via this auxiliary quantity (Equation (15 The left-hand side of)) This is the square: the number y. It should be noted that this factor F is not necessarily chosen to be so large that these numbers and one Q are completely absent from the register shown in Figure 3. Overlap. Even when these numbers do have a certain range of overlap, as will be pointed out below, it is possible to square the number Q via this auxiliary number. To this end, further modulus reductions will be based on the equation (16) To be implemented:

Page 15

Equation (1 6) corresponds to this factor F, which is also considered now. Equation (4), however, equation (丨 6). In this example, you want to subtract ~) from the result of equation = 丨 5 S 戽. The result Q is obtained by equation (i 6 get:

(HQ) 17 When this auxiliary quantity (also the differences should be pointed out. When · difference-· F-Q) is negative, when the next value is negative, the modulus (the difference of the formula of N · ρ (15) η · ρ is q on hand, because by definition + 1) the left hand side of equation (15) is added. In this way, when the result of this auxiliary counting and reduction will always remain positive on the left-hand side, the present invention also needs to add a negative number and add the modulus to equation (15)), as shown below: (U) Subtract the equation (15

mod (N · F)-A · F mod (N · F +1) + (18) In the following, we will refer to Figure 1, which represents the calculation of the division result of the numerator and denominator or its integer multiple (as shown below) Will be pointed out). For convenience of explanation, these definition operations are shown in block 10 in FIG. This device according to the invention has a device 12 for providing a factor

Page 16 200304616 V. Description of the invention (12) (especially the number e), this factor is formed into the exponent of the base 2 so as to satisfy inequality (6) and inequality (7) respectively. In addition, the device according to the present invention also has device 4 for calculating this and for performing equation (15). Finally, according to the present invention, the machine ^ described in FIG. 3 is set to 16 for using various methods (for example, using ΓΛ & Λ / or calculating an additional modulus approximation (Equation ⑴ and the number of help squares The number Q. <, mouth fruit), through this supplement in the following, we will refer to Figure 2, the preferred method of borrower, that is, we need four temporary cuts in tears, stubbornly stand on the A Brother register, the second register of the denominator N. Among them, the fifth surname if: temporarily stores as, and the second auxiliary quantity Η2-, r, if the result register of the brother five is acceptable, the numerator temporarily holds the test, Eight and then seven can be used selectively, or the OR can also be used as a result register, if the need = = 1, the three temporary storage in step 20 'the value e will first root, and then, the molecular register will Load the first product A.FY cow 8) to choose. The second register will also be reloaded with the mother register 5 ^ 2 step 22). Subsequently, the fractional modulus is approximately divided according to equation (16) $ to two,). In step 26, the denominator is then incremented by i, so in step 30. After the calculation of step 26 '(15). In step 32, the two-phase open center division equation is then executed, such as the subtraction of equations (7, 4 (1 5), and (1 6)). In step 34: we are in step 仏The difference will be followed by the result being negative, then the two; whether the solid result is negative. If the result of the division Q is reached (step 38 is added (step 36)) to obtain

Page 17

Hi 200304616 V. Description of the invention (13) If the result on the right is not negative, then step 3 4 will judge: the result obtained in step 3 2 is greater than 0, and this result will then be directly output as the result of the division (step 38, ). It should be noted that the embodiment of FIG. 2 of the present invention will be particularly advantageous when the number of binary long registers 3 0 0 and Q of FIG. 3 overlap, because FIG. 3 The procedure of selecting the lowest bit of register 300 and inverting it to get result q will not produce the correct result at the same time. In the embodiment of FIG. 2 of the present invention, the knot / device 16 will have the functions of steps 26, 32, 34, and 36 via the difference H.2e-Q-squared. As will be mentioned below, in the case where the method according to the present invention can =, the calculation of the division result is: = = (^^. 1) Λ // Λ: 5)? / Λχ > 1

Simultaneously multiply this integer χ to obtain the lower left-hand side result Q Η χ A · F mod (ν · 19 When the number X is greater than 1, the equation ^ means that the factor must be χΛ and the factor F must be considered. Choose modulo approx. I: "results Q, but this modulus (N.F + X) (the number of reductions can also be compared to ten X with χ = 1). Divide the result Q by χ to achieve. Special / When θ is easily calculated, this can also be invented by using the binary system where the time = an integer multiple and;; the corresponding number of positions are achieved. w can also flatten the register to the right "

200304616 V. Description of the invention (14) Equation (1 9), which is similar to equations (丨 6) and (丨 7), will get X times the number Q. Another method for the number of squares Q and its integer multiples (via equation (19)) includes using the following equation (20) to solve; equation (20) roughly corresponds to equation (1 9) ' But in this example, the integer y must be different from the number X. When equation (19) is subtracted from equation (19), equation (21) can be obtained. On the left-hand side of equation (21), this result Q will no longer be generated, but an integer multiple of this result Q, that is, the difference between the integer y and the number χ. This result Q can be divided by (y — χ) and obtained again via equation (2 丨). This division can be omitted provided that the difference between the integer y and the number x is exactly equal to one. (20) A · F mod (21) HFQ.y = A- F mod (N · F + y) (y—x) = A- Fm〇d (NF + x) (N · F + y) Formula ( In particular, it should be noted that 'this 13') to (15,) In view of this, the present invention is applicable to a program in which the cryptographic algorithm is effectively implemented and the parameters X and y can be described. ’Because of its flexibility, security, and cipher coprocessor, the circuit design. It is a negative number, similar to equivalence, performance, and will usually have security on it. 200304616 A brief description of the diagram. Figure 1 is a block circuit diagram showing a division calculation device according to the present invention. Fig. 2 is a block circuit diagram showing a method according to a preferred embodiment of the present invention. Figure 3 shows the auxiliary quantity representation of the binary long number register to explain

In vain, this is a step that assists in counting the results. Element. Symbol description 10 Definition block 12 Provides device 14 Modulus reduction device 16 Square device 20 Determines the number of assistants 22 Calculates the first — product 24 Calculates the — i — product 26 Calculates the number — the number of secret assistants 28 Incremental modulus 30 Calculates the assistance Quantity 32 Subtract auxiliary quantity from additional auxiliary quantity 34 Check result symbol 36 Add modulus 38 ¥ m Out result 38 'Wm Out result 300 Long register

Page 20

Claims (1)

200304616 6. Scope of patent application 1. A device for calculating a division result (q) of a numerator (A) and a denominator (N) and an integer multiple of the division result (Q) includes: a device (12) for Provide a factor, wherein the factor is selected such that the factor and the denominator (N) can be greater than the result (Q); the device (14) uses a second product equal to the denominator and the factor and one of an integer Sum a modulus to perform a modulo reduction of the numerator and the factor to obtain an auxiliary quantity including the result; and a device (16) for exposing the result or an integer of the result by the auxiliary quantity Times. 2. The device according to item 1 of the scope of patent application, wherein the providing device is designed to determine the factor, so that the factor is equal to a base number, an auxiliary number index. 3. The device as described in item 2 of the scope of patent application, wherein the base number is 2, whereby the multiplication of the factor corresponds to one of the number of positions in a register, and the plural position is equal to the auxiliary number. 4 · The device described in item 1 of the scope of patent application, Where 'negative numbers are represented by 2, s complement numbers, and where' the auxiliary quantity is stored in a temporary register (300), and where 'the square device (16) includes a device for reading including A low-order part (Q) of the register of the result, and a device for reversing a read value and adding 1 to obtain the division result (Q). 5 · The device as described in item 1 of the scope of patent application, wherein ‘the square device (丨 6) includes: Page 21, 200304616 6. Scope of patent application "-device (2 6), used for calculation, as an additional auxiliary quantity, the numerator multiplied by one of the factors, the result is about one-half of the result, where, multiplied by The denominator of the factor is provided as a modulus; and a device (32) for subtracting the auxiliary quantity from the additional auxiliary quantity to obtain the division result. 6. The device according to item 1 of the scope of patent application, wherein 'the division is an integer division. 7. The device as described in item 3 of the scope of patent application, wherein the selection of the auxiliary number is made equal to the number of positions of the numerator minus twice the number of positions of the denominator plus two. 8. The device described in item 5 of the scope of the patent application, /, the square device (方 6) is a square arrangement to decide (3 4): whether the knot f is negative, and in this example, This modulus is added to the result and refined for use in the modulus reduction device (14). 9. The device as described in item 5 of the scope of patent application, further comprising: a, a register for storing the numerator (A); a second register for storing the denominator (N); A third register for storing the additional auxiliary quantity (H2); a second and fourth register for storing the auxiliary quantity; and an ancient: register control unit 'for controlling the computing device (14) and The opening device (16) obtains the result (Q). 10. The device according to item 丨 in the scope of patent application, wherein the result is calculated by multiplying by an integer multiple, and the providing device (12) in the eighth middle school is arranged to provide a factor, wherein, Circle I Sun Page 22 200304616 The choice of the factor is hurt # m & multiplying the result, the denominator should be the integer f, and the denominator-product, and the number of jade numbers by j is greater than the result of the division, and where the modulus is approximately divided The 4 (1 6) system is designed to use a modulus equal to the product of one of the four numbers and a sum of the integer multiples. 11. The device according to item 1 of the scope of patent application, wherein the modulus reduction device (1 4) is designed to use a modulus equal to the product of the denominator and one of the factors and the sum of an integer, In the complex, the integer is greater than or equal to 1, and eight of the 'the square device (丨 6) is arranged to perform a modulus using a modulus equal to the product of the denominator and one of the factors and the sum of an additional integer. In the reduction, the additional integer is different from the integer, so that the square device (16) can obtain the division result or multiply the result when the difference between the additional integer and one of the integers is equal to 1. An integer multiple, the integer p is equal to the difference between the additional integer and the integer. 1 2 · The device described in item 1 of the scope of patent application, which is designed as a cryptographic coprocessor of a cryptographic device. 13 The device according to item 1 of the scope of patent application, wherein the integer is a negative number, so that the result can be obtained without reversing. 14. The device as described in claim 11 of the scope of the patent application, wherein the additional integer is a negative integer ° /, step 15 · — a kind of calculation of the factory division result (Q) of one numerator (A) and 〆 denominator N and The result (Q)-a method of integer multiples' The method includes the following 200304616 6. Scope of Patent Application. Provide (12) — a factor, where the choice of the factor is such that the product of the factor and the denominator (N) is greater than the result (Q); using the sum of the second product of the denominator and the factor and an integer A modulus, the modulus is approximately divided (14) the denominator and a first product of the factors to obtain an auxiliary quantity with the result; and the result or the result is (1 6) squared by the auxiliary quantity The integer multiple. Page 24